Indonesia has emerged as an early testing ground for a new Android banking malware technique that uses Google's Work Profile feature to help fraudsters evade banking security controls.
According to Group-IB, its researchers observed roughly 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia between February and July, resulting in nearly $1 million in estimated losses.
In research published Sept. 9, Group-IB described an Android banking malware technique used by the threat actor GoldFactory. GoldFactory is a Chinese-speaking threat group focused on mobile banking cyberattacks for financial gain. The ultimate goal is to clone a victim's banking app into an isolated environment where malware detections and fraud signals may not follow.
The malware used in this campaign is Gigabud, a banking Trojan targeting Android devices and active since 2022. It's used in attacks across Southeast Asia, South Asia, the Middle East, Africa, and Latin America. While the lure and infection context varies by region (attackers impersonated national airlines, tax authorities, and government portals), the malware generally grants an attacker immense influence over a target device. Once installed and granted the necessary permissions, the malware gives operators live remote control of the victim's phone.